Privacy Policy

1. Who we are

ecomealz ("we," "us," or "our") is the operator of the ecomealz surplus-food marketplace. We act as the data controller responsible for the personal information described in this policy.

For any privacy question or to exercise your rights, contact us at support@ecomealz.com. This is our designated contact for data protection matters.

2. Information we collect

We collect only what we need to run the marketplace. The table below summarizes each category, and the details follow.

Information you provide

• When you create an account — with email and password we collect your name, email, an optional phone number, and your password (stored only as a secure hash). With Google or Apple sign-in we receive a unique identifier, your name, and your email address; if you use Apple's "Hide My Email," we only receive Apple's private relay address.
• When you edit your profile — you may upload a profile photo, which is selected from your device's photo library and stored with your account.
• When you contact us — any information in your support requests, reviews, or feedback.

Information generated when you use the Services

• Orders and pickups — the bags you reserve, quantities, prices, order status, your pickup QR code, and related timestamps.
• Loyalty and rewards — points you earn at pickup and redeem for discounts, plus, where offered, referral and lottery/raffle records.
• Push notification token — a Firebase Cloud Messaging token linked to your account so we can deliver notifications.

Location information

Payment information

ecomealz currently operates on a cash-at-pickup basis: you reserve a bag, receive a QR code, and pay the partner directly when you collect. We therefore do not collect or store your card or payment-card details in the app today. Card payments (via a third-party payment processor, Tap Payments) are planned for the future; if and when we launch them, we will update this policy and your card details will be handled by that processor — not stored on our servers.

Information we do not collect

We do not use advertising identifiers (such as IDFA), we do not include third-party advertising or cross-app tracking SDKs, and we do not sell your personal information. We do not ask for App Tracking Transparency permission because we do not track you across other apps or websites.

3. How and why we use your information

We use your information to:

• Create and manage your account and authenticate you when you sign in (email/password, Google, or Apple).
• Provide the marketplace and fulfil your orders — process reservations, generate your pickup QR code, and share the necessary details with the partner so they can prepare and hand over your bag.
• Run the loyalty program — award points at pickup, apply redemptions and discounts, and, where offered, manage referrals and raffle entries.
• Send notifications — order confirmations, pickup reminders, status changes, and important account or service messages via push notifications.
• Provide customer support and respond to your questions, reviews, and feedback.
• Maintain, secure, and improve the Services — detect and prevent fraud, abuse, and technical problems, and understand aggregate, non-identifying usage to improve the product.
• Comply with legal obligations and enforce our Terms of Service.

4. Legal bases for processing

Where data-protection law (such as the EU/UK GDPR or comparable laws) requires a legal basis, we rely on the following:

• Performance of a contract — to create your account, take and fulfil your orders, and operate the loyalty program you take part in.
• Consent — for optional features such as sending push notifications, taking a coarse web location reading, and accessing your camera or photo library. You can withdraw consent at any time (for example, in your device settings).
• Legitimate interests — to keep the Services secure, prevent fraud and abuse, and improve our product, balanced against your rights and freedoms.
• Legal obligation — where we must retain or disclose information to comply with applicable law.

5. Device permissions

The app asks for the following permissions only when needed, and only for the stated purpose. You can grant or revoke each of them at any time in your device settings.

• Camera — to scan the QR code at pickup.
• Photo library — so you can choose a profile photo. (Photos are not read unless you select one.)
• Push notifications — to send you order and account notifications.
• Location (web/PWA only) — an optional, coarse reading to auto-select your city, as described in Section 2.

6. Who we share your information with

We do not sell your personal information. We share it only in these limited situations:

• Partner restaurants, bakeries, and cafés — to fulfil your order, the relevant partner receives what they need to prepare and hand over your bag (for example, your order details and pickup QR code).
• Google (Firebase Cloud Messaging) — we use Firebase to deliver push notifications; your notification token is processed by Google for this purpose.
• Google and Apple (sign-in) — if you choose social sign-in, your identity is verified with the provider you select.
• Map and tile providers — the in-app map uses OpenStreetMap tiles. As with any online map, the tile server may see your device's IP address to serve the map images.
• Future payment processor — if we launch card payments, a payment processor (Tap Payments) will handle your card data directly under its own privacy terms.
• Legal and safety — where required by law, to respond to lawful requests, or to protect the rights, safety, and property of our users, partners, or ecomealz.
• Business transfers — if ecomealz is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

7. Analytics and advertising

We do not use third-party analytics SDKs, advertising networks, cross-app trackers, or advertising identifiers in the app. Any usage statistics we keep are aggregate business metrics generated on our own servers and are not tied to advertising or to your device's tracking identifiers. We do not serve ads and we do not sell or share your data with advertisers.

8. Cookies and local storage

On our website and web app we use cookies and similar local-storage technologies that are strictly necessary to run the site — for example, to keep you signed in and remember basic preferences such as your language and city. Your authentication token is stored securely on your device (in the browser or, on mobile, in the device's secure keychain/keystore). We do not use advertising or third-party tracking cookies. You can clear or block cookies in your browser settings, though some features may not work if you do.

9. Data retention

We keep your personal information for as long as your account is active and for as long as needed to provide the Services, operate the loyalty program, resolve disputes, and comply with our legal obligations. Order and loyalty records may be retained where required for legitimate business, accounting, tax, or legal purposes.

When you delete your account, we delete or anonymize your personal information within 30 days, except where a longer period is required by law or for legitimate purposes such as fraud prevention or resolving an outstanding dispute.

10. Your rights and choices

Subject to applicable law, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information — you can update your name, email, phone, and photo directly in your profile.
• Delete your account and personal information (see Section 11).
• Object to or restrict certain processing, and withdraw consent where processing is based on consent (for example, turning off notifications or location in your device settings).
• Data portability — request a copy of the information you provided to us in a portable format.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email us at support@ecomealz.com. We will respond within the time required by applicable law. We may need to verify your identity before acting on a request.

11. Deleting your account

You can delete your ecomealz account and associated personal information at any time. You may request deletion directly in the app, or by emailing us at support@ecomealz.com from the address associated with your account. Once your account is deleted, your personal information is removed or anonymized within 30 days, except where retention is required by law or for the legitimate purposes described in Section 9. Some records already shared with a partner to fulfil a completed order, and records we must keep for legal or accounting reasons, may be retained for the applicable period.

12. Children

The Services are not directed to children. You must be at least 16 years old (or the minimum age of digital consent in your country, and in any case at least 13) to create an account and use ecomealz. We do not knowingly collect personal information from children under this age. If you believe a child has provided us with personal information, please contact us at support@ecomealz.com and we will delete it.

13. International data transfers

ecomealz operates in the United Arab Emirates and Azerbaijan, and we use service providers (such as Google/Firebase) that may process data in other countries. This means your information may be transferred to, stored in, and processed in countries other than the one you live in, which may have different data-protection laws. Where we transfer personal information internationally, we take steps to ensure it remains protected in line with this policy and applicable law, including using appropriate safeguards where required.

14. Security

We take reasonable technical and organizational measures to protect your information. Passwords are stored only as secure hashes, connections to our servers are encrypted in transit, and your authentication token is stored in your device's secure keychain/keystore. Social sign-in tokens are verified server-side against Google's and Apple's own systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond appropriately to any incident.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our Services or legal requirements — for example, when we introduce card payments. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app or by other means. Your continued use of the Services after changes take effect means you accept the updated policy.